Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Remediation
References
https://github.com/thenables/thenify/blob/master/index.js%23L17
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
Related Vulnerabilities
CVE-2021-44585 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base
CVE-2023-32732 Vulnerability in maven package io.grpc:grpc-protobuf
CVE-2020-11023 Vulnerability in maven package org.webjars.bowergithub.jquery:jquery
CVE-2022-41713 Vulnerability in npm package deep-object-diff
CVE-2023-26049 Vulnerability in maven package org.eclipse.jetty:jetty-server